Performance Objectives 
And Instructional Cues 


OUTLINE AND PRESENTATION 


LESSON PLAN 
INTRODUCTION 

A. Course Title: Technology Crimes 
Instructional Goals: 

Computer Crimes, Introduction to Computers, Child Sex 
Crimes and Computers, Processing Computers, Technology & 
Police and Topics Of Discussion 


Instructional Objectives: 

To give basic knowledge to Cadets or Recruits 


Instructional Methods: 

Class lecture with class participation and overheads 
Estimated Time: 2 hrs 

Instructor_Presentation 

Date_ 

Prepared by: Debbie Pruitt, NMJC 

Approved by: NMLEA JAN 2014 

Revised_ Date_ 


• Agenda 

• Computer Crimes 

• Introduction to Computers 

• Child Sex Crim ?s and Computers 

• Processing Computers 

• Technology & Police 

• Topics Of Discussion 

• What is Computer Crime? 

• Computer Rela ed Crimes 

• Computer Spec ific Crimes 

• Unique Challenges of Computer Crime 
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What Is Computer Crime? 

You know whal crime is... 

You know whal computers are... 

But what is computer crime? 

Let’s define computer crime... 

What Is Computer Crime? 

There is no one correct answer. 

Different jurisd ctions define computer crime in various ways. 

What Is Computer Crime? 

A Computer May Be: 

» Instrumentality of a crime (Tool) 

» A reposi ory of evidence (Ancillary to Crime) 

» Fruit of t le crime (Target) 

» Contraband 

How Computers Are Used by Criminals 
Accounting/spi eadsheets 
Data bases 

Telecommunic;itions/access/e-mail 
Word processing/diaries 
Graphics 

A New Generat on of Criminal 

Criminals "adapt and adopt" new technologies 
Credit card "skimmers” 

ATM card readers 
Identity Theft 

Scams and fraud migrate online 
A New Generat on of Criminal 

Consumer Spending Online: 

$65 billion in North America predicted in 2001 

Money Transfers over the Fedwire: 

1998 - 389,269 ransfers daily, $1,304 trillion in value 

1999 - 407,925 ransfers daily, $1,362 trillion in value 

2000 - 429,816 ransfers daily, $1,506 trillion in value 
Problems In Reporting Computer Crime 

Computer Crime falls "between the cracks" of formalized reporting 
Computer Crime is underreported by corporate victims 

In a 2000 survey, 38% of corporate victims failed to report intrusions to anyone. 
Reasons given were: 

» Fear of iv egative Publicity 
» Competi ors finding out 
» Civil remedy sought instead 
» Unaware the incident could be reported 
Computer Rela ed Crimes 
Bubble Theory of Fraud- 

» Fraud migrates to an area of lesser control 
» Potter’s l.aw- 

» Fraud oqcurs at the point of least resistance 
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Computer Rela 
Cellular Phone 
» Analog 
» Digital 
PBX (Private Bi 
» DISA 
» Voice Me 
» Traffickii 
» Looping 
Computer Spec 
Theft of compo 
» Memory 
» Shipmen 
Theft of laptop; 
» Business 
» Airports 
» Federal I 
Computer Spec 
Internet Technc 
» Easy acc 
» Scanner; 
» Privacy t 
Innocent Image 
» FBI oper 
» 400+ cor 
Computer Spec 
Access bankini 
Access Air Tra 
Access Electric 
Access Pharrm 
» National 
Bloomberg LP, 
hackers 
Computer Spec 
Value of Intelle 
Ways of access 
» Dumpste 
» Social Ei 
» Physical 
» Surplus 
Computer Spec 
Male 

White or Asian 
Share informat 
Young 

Focused on tec 
Organizations ■ 


ted Crimes 
Cloning/Fraud 

anch Exchange) hacking 


ig of Stolen Phone Access Codes 

ific Crimes 
nents 

and other components removed from computers 
ts of memory chips are being hijacked 
> 

;es, Universities 

; acilities 
ific Crimes 

>logy - a bonanza for child pornographers... 

ess to like-minded people through newsgroups, IRC, chat rooms 

>, Digital Cameras, Web Cams now cheaply available 

schnologies have made anonymity easier 

s - 

ition begun in 1995, Baltimore Field Office - now in 11 Field Offices 
victions to date, 
ific Crimes 
) computer systems 
fic Control Systems 
Power Grids 

iceutical/Medical systems 
Library of Medicine Intrusion 

a financial information company, blackmailed for $200K by would-be 

ific Crimes 
;tual Property 
ling information: 
r Diving 
igineering 

access to facilities by custodial or security personnel 
lard drives not sanitized 
ific Crimes 

A Profile: 

on with others: through news-groups, IRC, websites, publications 
hnology 
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» lOpht 
» Cult of Vr 
» Phrack, 
Computer Spec 

Pirated Softwai 
Cracking Copyi 
Web Page Vane 
System Intrusic 
Denial of Servit 
Steal Credit Ca 
Computer Spec 

Paul Barton, a 1 
operations for - 
Herbert Pierre-I 
FL, remotely ac 


The Challenge 

» Who lnv< 
» Coopera 

» Anonymi 
» Spoofing 
» Compror 
The Challenge 

» Accessit 
» Moore's 
» Hard Dm 
The Challenge 
Lack of Adequc 
Lack of Technii 
Case Law Still i 
The Challenge 
Financial 
» Purchast 
» Training 
Manpower 
» Permane 
» Prioritizii 
Conclusions... 
Criminals are a 
Criminals' ecor 
Criminals will i 


e Dead Cow 
2600 

ific Crimes 
Activities: 
e - (Warez) 

ighted Software(Games) 

lalism 

ms 

:e (DoS) Attacks 
'd Info From Websites 
ific Crimes 

71% of businesses reported unauthorized access by insiders in 1999 
ired Intel employee, deleted critical files, shutting down a plant's 
L hours, causing $20,000 in damages. 

_ouis, Jr, a computer specialist at Purity Wholesale grocers, Boca Raton, 
cessed several sites, unleashing a virus, causing $80K of damage. 

In 1999, 53 businesses surveyed reported a loss due to electronic 
financial fraud totaling $55,996,000 
3f Cybercrime 

Electronic Crime Scenes may span multiple jurisdictions 
sstigates? Who charges? 
ion of Agencies is necessary 

Identification/location of the perpetrator may be difficult 
ty technology 

lised accounts 
3f Cybercrime 

Keeping Up With The Pace of Technology 
ility of PC's and the Internet 
_aw 

re Sizes make thorough searches more difficult 
3f Cybercrime 

ite Legislation for Computer Offenses 
;al Knowledge by Judges, Attorneys 
n Early Stages for Computer Crime 
3f Cybercrime 

i & Maintain Equipment for Examinations 
Expenses 

nt vs Rotating Position 
ig Computer Crime vs "Real Crime" 

constant in society, 
lomic needs are continuous. 

tilize and adapt the latest technologies to their ends. 
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* Criminals steal from where the wealth is stored 

* Conclusions... 

Investigators need new resources, skills, perspectives and 
techniques to enable them to continue to be effective as we enter 
the... 

* Review... 

* Definition and Scope of Computer Crime 

* Technological Challenges - Internet, Rapid Evolution of Technology 

* Fraud, Counterfeiting, Sexual Victimization of Children 

* Jurisdictional and Legal Problems Concerning Cybercrime 


Child Abductiof 


USB THUMBDRIVE 
THUMBDRIVE 
THUMBDRIVE 
THUMB DRIVES 
TREK 

THUMB ATTACHED TO USB PORT 

DRIVERLESS L SB 

JAZZ DISK 

MULTIMEDIA CARD 

SMARTMEDIA MEMORY 

SONY MEMORY STICK 

SONY MEMORY MOUSE 

ZIP DRIVE 

ZIP DISK 

QUESTIONS???? 

Internet Crimes Against Children 
Child Abductioi Statistics 

Good News 

75% of all children return within 24 hours 
95% of all abducted children return alive 

Bad News 

There are predators who abduct and murder children 

44% die within the first hour 

74% die within the first three hours 

99% die within the first 24 hours 

40% are dead before they are reported missing 

70% of those Ic cated are found by accident not by a good search 

1999 Abductions 

262,100 total abductions 

» 203,900 of these were family abductions 

• almost 75% of these were taken from their own home or another’s home or 
ya'd 

» 58,200 ol these were non-family abductions 

• 99 Vo returned home 

• only 115 of these were of the most serious type 


» 203,900 ( 
* air 
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• air lost 60% of the 115 were returned safely 

• over 50% were taken from the street, from a vehicle, or from a park or 
wooded area 

* Non-Family Abductions 

Most missing children are not abducted 
» poor supervision 
» lost 

» domestic discord 
» runaway 

* Most at Risk 

* female 

* Caucasian 

* school age 

* Initial Assessment 

* ASSUME THE WORST UNTIL PROVEN OTHERWISE 

* witnesses’ accounts of the incident (if any) 

* the victim’s ago 

* activity the victim was engaged in when last seen 

* history of disappearances 

* prior incidents with family 

* any previous similar incidents within the area that were reported to the police 

* Law Enforcement 

If a child is missing: 

* An accurate evaluation of the missing-child episode is absolutely vital to proper case 
handling and s jccessful resolution 

* How does this apply to computers? 

* Bad Guys 

* Used to roam parks, schools, arcades, etc. 

* Bad Guys 

* Now access your children through the Internet 

* Online Victimization 

Study printed in June 2000 

1,501 youths ages 10-17 who use the Internet regularly (at least once 
a month) were surveyed 

* Online Victimization 

* 1 in 5 received a sexual solicitation or approach over the Internet in the last year 

* 1 in 33 received an aggressive sexual solicitation 

* 1 in 4 had unwanted exposure to pictures of naked people,or people having sex in the 
last year 

* Online Victimization 

* 1 in 17 was threatened or harassed 

* Approximately 1/4 of young people who reported these incidents were distressed by 
them 

* less than 10% of sexual solicitations and only 3% of unwanted exposure episodes were 
reported to aut lorities 

* Online Victimization 

* About 1/4 of thp youth who encountered a sexual solicitation or approach told a parent 
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Almost 40% of 
Only 17% of yo 
they could mak 
Online Victimiz 
In households 
blocking softw; 
For youth enco 
of: 

Searches (47% 
» www.but 
» www.fbi. 
» www.whi 
Misspelled add 
» www.enc 
Links in web si 
Online Victims 
Girls 66% vs. B 
77% were age 1 
The 10-13 year 
Do the Victims 
49% did not tel 
10% reported t< 
Online Perpetrj 
97% were persi 
How offenders 
Identify the vici 
Groom the vict 
Educate the vie 
Access victim 
and... 

Identify other s 
Educate other < 
Validate suspei 
NAMBLA (Nort 
Rene Guyon S< 
PIE (Pedophile 
SO... 

If it is determin 
find out access 
request immed 
ask parents abi 
» chat rooi 
e-mail, b 
secure the mis: 
secure any oth 
search warrant 


those reporting an unwanted exposure to sexual material told a parent 
nth and approx. 10% of parents could name a specific authority to which 
e a report 
ation 

with home Internet access, 1/3 of parents said they had filtering or 

ire on their computers at the time they were interviewed. 

untering unwanted exposures to sexual material, it came up as a result 


[.corn 

:om 

tehouse.com 
resses (17%) 
yclopdia.com 
tes (17%) 

oys 34% 

4 or older 

olds were disproportionately distressed 
Report? 
anyone 

) authorities (teacher, ISP, or law enforcement 
itors 

>ns the youth originally met online 
use the Internet 


uspects 
suspects 
;t behavior 

l American Man/Boy Love Association 

>ciety (motto is “sex before eight or else it’s too late”) 

Information Exchange) 

sd that the child might have been abducted or has run away: 
ibility to a computer 

iate assistance from an on scene analyst 
)ut child’s online activity 

ns, private chat rooms, education rooms, game rooms, teleconferencing, 
jlletin boards 
>ing child’s room 
jr possible crime scene’s 


» crime sepne locations (to include suspect’s home) 
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» computers (victim’s and suspect’s) 

If the child has been a victim but has NOT been abducted: 

Obtain as much information as possible from the child 

» detailed nformation about individuals he/she has chatted with 
» screen n ames 


» pass wo r 
» bulletin I 
» newsgro 
UNDERCOVER 
Parents should 
be totally and c 
know what the} 
know where th< 
know whom th< 
know their frier 
know the parer 
know your neic 
know your teac 
monitor their ai 
monitor and be 
don’t be apprei 
www.missingki 
INTERNET CRI 
MANUFACTUR 
DISTRIBUTION 
SEXUAL EXPU 
SEXUAL HARA 
KIDNAP 
MURDER 
Introduction 

New Mexico La 
Federal Law 
TYPES OF CRII 
Child luring / tr 
Child pornogra 
CHILD LURING 
TRANSPORTA- 
CHILD LURING 
30-37-3.2(B) Nl\ 

induce a child i 
by means of a < 
to engage in se 
when perpetrat 


as 

>oards 

up subscriptions 
OPERATIONS 

ompletely involved with your children 

r are wearing 

jy are going 

»y are going with 

ids 

ts/guardians of the friends 
hbors 

hers/coaches and people who work at the school 
itivities on the computer 
aware of changes in behavior and demeanor 
tensive about confronting issues that concern you 
ds.com 

VIES AGAINST CHILDREN 
E CHILD PORNOGRAPHY 
OF CHILD PORNOGRAPHY 
STATION 
SSMENT 


LAW OF CHILD INTERNET EXPLOITATION 


l/IES 

ansportation 

phy 

& 

riON 

ISA 

It is a crime to: 
jnder 16 
:omputer 

x act or obscene performance 
or is 3 years older / victim 

[4th degree felony] 
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TRANSPORTA' 
SEXUAL ACTIV 
18U.S.C. §242 

Persuade, indu 
through interst 
a child under 1 
to engage in cr 

TRANSPORTA' 
18U.S.C. §242 

travel interstate 
with intent to e 
With a child un 

MAKING CHILE 
PORNOGRAPH 
SEXUAL EXPU 
OF CHILDREN 
30-6A-3 (C) NM 

cause or permi 
to engage in ar 
with intent to re 


ION FOR ILLEGAL 
ITY 

2(b) 

It is a crime to: 
ce, entice, or coerce 
ate commerce (mail/internet) 

3 

minal sexual activity 

[10 years imprisonment] 
'ION OF MINORS 
3(b) 

It is a crime to: 

; 

igage in criminal sexual activity 
Jer 18 

[15 years imprisonment] 


STATION 


SEXUAL EXPU 
OTHER ABUSE 
18U.S.C. §225 

cause a child te 
to produce a vi 
if the child/dep 

POSSESSION 
OF CHILD 
PORNOGRAPI 
SEXUAL EXPU 
OF CHILDREN 
30-6A-3 (A) NM 

intentionally pc 
which depicts | 
in which a part 


It is a crime to: 
t a child 

y obscene sexual acts 
‘cord the acts 

[3rd degree felony-under 18] 
[2nd degree felony-under 13] 

STATION & 

OF CHILDREN 
1(a) 

It is a crime to: 

) engage in sexually explicit conduct 
sual depiction of the conduct 
ction/materials used, travel interstate 

[10-20 years imprisonment] 


Y 

MTATION 


It is a crime to: 

ssess obscene visual or print medium 
irohibited sexual acts 
cipant is a child 

[4th degree felony] 
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SEXUAL EXPLOITATION 
OF CHILDREN 
30-6A-2 (E)NMGA 

Obscene defined: 

appeals to prurient interest in sex-average person/contemporary community standards 

portrays prohibited sex in patently offensive way 

lacks serious literary, artistic, political, or scientific value 

SEXUAL EXPLOITATION & 

OTHER ABUSE OF CHILDREN 
18 U.S.C. § 2252(a)(4)(b) 

It is a crime to: 

possess a depiction of a child engaging in sexual conduct 
which passes i iterstate or internationally 

[5 years imprisonment] 

DISTRIBUTION OF 
CHILD PORNOGRAPHY 
SEXUAL EXPLOITATION 
OF CHILDREN 
30-6A-2 (B) NM3A 

It is a crime to: 

distribute obscene visual or print medium 
which depicts prohibited sexual acts 
in which a chile participates 

[third degree felony] 

SEXUAL EXPLOITATION & OTHER ABUSE OF CHILDREN 
18 U.S.C. § 225 2(a)(2) 

It is a crime to: 

Transport, ship, distribute, sell, or possess with intent to sell 
A depiction of a child engaging in sexual conduct 
Which passes interstate or internationally 

[15 years imprisonment] 

MANUFACTUR NG 
CHILD PORNOGRAPHY 
SEXUAL EXPLOITATION 
OF CHILDREN 
30-6A-3 (D) NM5A 

It is a crime to: 

manufacture obscene visual or print medium 
which depicts prohibited sexual acts 
in which a chile participates 

[2nd degree felony] 

SEXUAL EXPLOITATION & 

OTHER ABUSE OF CHILDREN 
18 U.S.C. § 225 2(a)(B)(2) 

It is a crime to: 
reproduce child pornography 
for interstate or international distribution 
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ADVERTISING 

CHILD 

PORNOGRAPH 
SEXUAL EXPU 
OTHER ABUSE 
18U.S.C. §225 

advertise, seek 
interstate or ini 
depictions of s 

Electronic Con 1 


[15 years imprisonment] 


• ECPAcont... 


ECPA cont... 
ECPA makes tv 


Questions? 

Processing Coi 
Intelligence Ga 
Site is a Home/ 
Physical site cl 
MIS - Cooperat 
Can informant i 
Evidence that y 
» Backup 1 
» Network 
» Selected 
Intelligence Ga 


STATION & 

OF CHILDREN 

He) (1) 

It is a crime to: 

, or offer 
ernationally 

jxually explicit children’s conduct 

[10-20 years imprisonment] 
munications Privacy Act (ECPA) 

• In 1986, Congress adopted the Electronic Communications Privacy 
Act (“ECPA”). 18 USC §2701 

• ECPA is the principal law governing law enforcement surveillance 
of electronic communications. Although mainly aimed at law 
enforcement, ECPA also imposes obligations on private parties, 
including Internet Service Providers (ISPs). 

• The ECPA was updated in 2001 with the USA Patriot Act. The 
Patriot Act amended the statute in numerous places to remove 
telephone-era language. The goal was to make the statute apply to 
the modern communications medium used today. 

io general distinctions in how to obtain evidence: 

First, it distinguishes between (1) information acquired in real-time, 
and (2) historical information. 

Second, it distinguishes evidence from an ISP into three categories: 
(1) the content of specific communications, (2) transactional 
information and (3) subscriber information 

Any Questions? 

nputer Crime Scene/Seizing Systems 
thering 

Business? Private, Public, Corporate? 

leek? 

ng? 

jet tech inside? 

ou seek can be stored in MULTIPLE LOCATIONS... 

'apes 

Drives (mirrored/redundant or arrayed systems) 

Servers/Firewalls 

thering 
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• Is there a stand alone or network computer in use? 

GET DESCRIPTION of computer! 

• What evidence do you want? 

• What type of O aer. System? 

• What software s in use? 

• How sophistics ted is the suspect? 

• Is there DATA HIDING or ENCRYPTION? 

• Sole Use or Multiple use of the so called suspected computer? 

• Wiretap or Date-scope, Keystroke Monitoring (legally sound)? 

• Raid Preparation: 

Some Tools Needed 
Computer Tool Kit 

» Screwdrivers 
» Wire Cut :ers 
» Hammer 
» Nail puller 

» Cables F oppy disks (color coded) 

» Floppy Sleeves 
» Batteries (CMOS, Regular, etc.) 

» Software 

• Raid Preparation: 

Items Needed 

• Bags - Large/Small 

• Boxes - Large/Small 

• Evidence - Wiring Tags 

• Bubble Wrap 

• Rubber Bands 

• Evidence Tags 

• Indelible felt tip pen 

• Raid Preparation: 

Items Needed/Considerations 

• Cameras; still, i/ideo, digital? 

• Audio Tape - your voice notes. 

• DNR or similar device 

• Laptop / Printer 

• Storage Facilities 

• Line-up resources, expertise needed? 

• Include expert assistance in S/W 

• Small Network Takedowns: 

» Take Wh at Computers? 

» Take the Server? 

» Take the Hard Drive Only? 

• Thoroughly bri if raid officers on what and what NOT to do. 

• What NOT to do. Please do NOT ... 

• Press or turn o i/off any electronic switches, buttons or controls. 

• Randomly pull wires. 

• Transmit on PCpLICE radios close to the computer. 
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* Allow “bad-gu\ ” or other confederate to touch computer system. 

* Remove anythi ig for evidence without first recording exact location/condition found. 

* Raid Preparation: Organization 

* First test equipment 

* Assign areas o responsibility 

* Review officer safety information 

* Review back-up contingency plans 

* Synchronize timing 

* Time raid so yc u have best control 

* With approval from Technical Team Leader... 

» NOW Disconnect modem lines from wall 

» Disconnect phone lines from wall. DO NOT UNPLUG MEMORY PHONES. FAX , 
OR MODEMS! Date is still there! 

* Processing the Scene 

* Decision: pull tie plug or not? (judgment) 

* Put clean bootcible floppies (disklock) in all drives and seal with evidence tape 

* Check internal aoards to be sure they are seated properly. 

* Processing the Scene 

* Photograph the entire crime scene S/W location (before & afters). 

* Photo or video any processes on the monitor (what is on the screen). 

* Photograph all books, papers, notes, etc. 

* Photograph bask of computer the wiring and DIP switch settings. 

* Note relative positions of manuals 

* Seize all manuals (most hardware and software as outlined in the S/W) 

* Color code rooms and hallways 

* Set up laptop computer and printer near exit 

* Use DBMS program to catalogue evidence & print evidence tags. 

* Teams should work assigned areas systematically 

* Look inside manuals and books 

* Look under deaks, tables, chairs, and in clandestine areas of concealment 

* Specifically LOOK for PASSWORDS or CODES the Perpetrator may have used 

* Processing the Scene 

* Cover keyboards with cardboard to protect keys. 

* Photograph an J diagram wiring 

* Tag both ends af all wires 

* Tag components and record ID information 

* Only disassem ile to facilitate transport 

* Pack and pad components in boxes 

* Label ends of t oxes 

* Record and pri it out inventory for owner (if required). 

* Transportation and Storage 

* Don't transport near radio antennas or power supplies 

* Keep media away from electromagnetic fields 

* Store in dry, clean location with moderate temperature 

* Transportation and Storage 

* Store floppy disks in sleeves and inside disk storage containers 

* Clearly label components with a " DON'T TOUCH OR OPERATE " warning 

13 







Performance Objectives 
And Instructional Cues 


OUTLINE AND PRESENTATION 


If all else fails or you do not know what to do.... 

» Contact ;i high tech crime investigator, aka. ME 
» Contact someone from the National White Collar Crime Center (NW3C) 
Five Things to look for: 

» Monitors 
» Cpu’s 
» Diskettes 
» Printers 
» Spike Stips 
What can I do far you? 
aka-High Tech Crime Investigator 
Un-hide hidden files 
Recover deleted data 
Recover data fiom mutilated diskettes 
Find unintended data (slack) 

Technology & Police 
Spike Belt 

Body Armor (LA Shootout) 

Scanner (Listen to your transmissions) 

Questions? 

Any Questions? 


14 










